Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SWQL Guidance for Scheduled Task Alert

Hi all

I'd like to create a query that allows Solarwinds to alert when a scheduled task hasn't run for the last 24 hours.

So far I have the following, but when I add in the date condition I get no data returned. If I reduce the query to what is in bold then the query returns a correct value.

SELECT Task.ID, Task.LastRunTime, Task.DisplayName as DisplayName FROM Orion.APM.Wstm.Task
WHERE Task.DisplayName LIKE 'TASKNAME' and LastRunTime > ADDSECOND(-3,GETUTCDATE())

Can anyone please offer some guidance on how to structure this so it captures any tasks that have not run in the previous 24 hours?

Thanks

Neil

Find more posts tagged with

Accepted answers

adam.beedell

ADDHOUR(-24?

KMSigma.SWI

There's already an out of the box alert for scheduled tasks called "Windows Scheduled Tasks: Alert me when task last run result is non successful" which you can duplicate and edit.

Then you can peek at the query behind the scenes.

Once you reformat the query, it becomes more legible.

SELECT E0.[Uri]
     , E0.[DisplayName]
FROM Orion.APM.Wstm.Task AS E0
WHERE (
          (
               NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The operation completed successfully.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is ready to run at its next scheduled time.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is currently running.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task will not run at the scheduled times because it has been disabled.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task has not yet run.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'There are no more runs scheduled for this task.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'One or more of the properties that are needed to run this task on a schedule have not been set.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The last run of the task was terminated by the user.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'Either the task has no triggers or the existing triggers are disabled or not set.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'Event triggers do not have set run times.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is registered, but not all specified triggers will start the task.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is registered, but may fail to start. Batch logon privilege needs to be enabled for the task principal.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The Task Scheduler service has asked the task to run.')
               AND NOT (
                    (E0.[ScheduledTaskAlert].[LastRunResult] = 'Incorrect or unknown function called.')
                    AND (E0.[ScheduledTaskAlert].[LastRunTime] IS NULL)
                    )
               )
          OR ((E0.[ScheduledTaskAlert].[LastRunResult] IS NULL))
          )

And if you wanted the last day, then I would make the WHERE clause's filter be [FieldYouAreChecking] > ADDDAY(-1, GETUTCDATE())

adam.beedell

Just got to drop the first 2 lines

(if you were trying to do something more complicated, you can JOIN after the forced section, though it's barely supported)

All comments

adam.beedell

ADDHOUR(-24?

KMSigma.SWI

There's already an out of the box alert for scheduled tasks called "Windows Scheduled Tasks: Alert me when task last run result is non successful" which you can duplicate and edit.

Then you can peek at the query behind the scenes.

Once you reformat the query, it becomes more legible.

SELECT E0.[Uri]
     , E0.[DisplayName]
FROM Orion.APM.Wstm.Task AS E0
WHERE (
          (
               NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The operation completed successfully.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is ready to run at its next scheduled time.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is currently running.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task will not run at the scheduled times because it has been disabled.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task has not yet run.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'There are no more runs scheduled for this task.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'One or more of the properties that are needed to run this task on a schedule have not been set.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The last run of the task was terminated by the user.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'Either the task has no triggers or the existing triggers are disabled or not set.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'Event triggers do not have set run times.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is registered, but not all specified triggers will start the task.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The task is registered, but may fail to start. Batch logon privilege needs to be enabled for the task principal.')
               AND NOT (E0.[ScheduledTaskAlert].[LastRunResult] = 'The Task Scheduler service has asked the task to run.')
               AND NOT (
                    (E0.[ScheduledTaskAlert].[LastRunResult] = 'Incorrect or unknown function called.')
                    AND (E0.[ScheduledTaskAlert].[LastRunTime] IS NULL)
                    )
               )
          OR ((E0.[ScheduledTaskAlert].[LastRunResult] IS NULL))
          )

And if you wanted the last day, then I would make the WHERE clause's filter be [FieldYouAreChecking] > ADDDAY(-1, GETUTCDATE())

neilrobson

Thanks @adam.beedell and @KMSigma.SWI , I followed both those suggestions and using SWQL studio I can find the data I want, however when I go to create the alert using Custom SWQL query, the validation fails! There is some text I can't edit

adam.beedell

Just got to drop the first 2 lines

(if you were trying to do something more complicated, you can JOIN after the forced section, though it's barely supported)

neilrobson

Thanks very much - working now!